Consumer privacy.

Existing law, the California Consumer Privacy Act of 2018, grants a consumer various rights with regard to personal information relating to that consumer collected by a business, including the right to know the categories and the specific pieces of personal information that a business collects and the right to opt out of the sale of personal information. Existing law defines personal information for these purposes and excepts deidentified information from that definition. Existing law defines "deidentified" in this regard as information that cannot reasonably identify, relate to, describe, be capable of being associated with, or be linked, directly or indirectly, to a particular consumer, provided that a business that uses deidentified information takes certain actions, including implementing technical safeguards and business practices that prohibit reidentification. This bill would revise the definition of "deidentified" for purposes of the California Consumer Privacy Act of 2018 to mean information that cannot be used to infer other information about, or otherwise linked to, a particular consumer, contingent on the business taking reasonable measures to ensure that the information cannot be associated with a consumer or household, commits to maintain and use the information in deidentified form, as specified, and to obligate a recipient by contract to comply with these provisions.